# 9.2 Key production and the verifier coupon

Key production selects the private scalar and derives the public point, and this subclause is also where the verifier coupon strategy appears. That is unusual: it lets a verifier with little power do the checking, and it changes what the verifier has to store and protect.

## What it asks

Record the private scalar source, the public point derivation and the coupon arrangement on the verifier. Show that a verifier coupon is used once and that exhaustion is handled, and keep the private scalar under the custody the clause assumes.

## What the revision does

The fourth edition will restate key production and the verifier coupon. The public record stops before the new rules.

## Who it binds

The key management owner and the verifier operator.

## Evidence an auditor samples

- The key record with scalar source and public point (key management)
- The verifier coupon policy, with single use and exhaustion (design note)
- The test that a reused verifier coupon is rejected (test suite)

## The test you can run

Ask what the verifier does when its coupon store is empty. If it falls back to a slower path without an alarm, the operational limit is unowned.

## Common failures

- Verifier coupons are reused across sessions.
- The scalar source is a general purpose random function with no strength review.

## How to close it

Treat the verifier coupon store as a protected asset with a count and an alarm. It is the part of this family that differs from every other, so it deserves its own line in the risk register.

## Source

ISO/IEC 9798-5:2009(E), 9.2, publisher preview; replaced by ISO/IEC DIS 9798-5, stage 40.20. Read on 21 October 2026. Our wording, not the instrument's.
https://www.iso.org/standard/89516.html

Not legal advice; does not certify.